[aw-doctor:compiler-security] gh-aw compiler run found actionlint, zizmor, and container scanner findings (grype/grant)

Compiler exit code 1 for `githubnext/gh-aw-cao` (47 workflow sources, 47 lock files). Findings: 2 actionlint expression errors, 46 zizmor High "github-app" findings (one per compiled workflow using `create-github-app-token`), 1 runner-guard medium permission warning, 20 grype Critical + 119 High CVEs across 9 container images (mostly `libssl3`/`libcrypto3`/`openssl` CVE-2026-63073 & CVE-2026-75803, plus npm `brace-expansion`/`tar`/`ip-address` advisories), and grant reporting 1250 license-policy findings (largely common permissive licenses — MIT/ISC — likely a policy config issue). yamllint and shellcheck showed no blocking findings (only unused-var style warnings).

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `47`
- **Generated lock files checked**: `47`
- **Result**: `findings`

| Tool | Workflow/Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint | self-care-dashboard-performance.lock.yml, self-care-pages-health.lock.yml | error | `safe-outputs-app-token` step output referenced but not defined in step outputs type | Fix the `.md` source's GIT_TOKEN expression/step-id wiring so the referenced step id exists in that job |
| zizmor | 46 workflows (aw-doctor, aw-failures-investigator, aw-maintenance-*, dependabot*, eu-cra-compliance*, optimization*, self-care*, software-development-practices*, uk-ai-advisory*) | High | `github-app`: dangerous use of GitHub App tokens (`actions/create-github-app-token`) | Review app-token usage per zizmor guidance; scope minimally or document/suppress if intentional |
| runner-guard | agentic_commands.yml | medium (RGS-005) | Excessive permissions on workflow reachable via untrusted trigger | Reduce write-scope permissions or restrict triggering context |
| grype | 9 container images (gh-aw-firewall/*, gh-aw-mcpg, gh-aw-node, github-mcp-server, alpine:latest, node:lts-alpine) | Critical (20), High (119) | CVE-2026-63073/CVE-2026-75803 (libssl3/libcrypto3/openssl), CVE-2026-5450 (libc6), GHSA brace-expansion/tar/ip-address (npm) | Bump base images / pinned digests to patched versions once upstream fixes are published |
| grant | 9 container images | policy (strict mode) | 1250 license-policy findings, majority common permissive licenses (MIT, ISC, BSD) | Review `.poutine.yml`/grant license allow-list — likely needs broader permissive-license allowance rather than image changes |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Summary: `Target: githubnext/gh-aw-cao; Exit code: 1; Workflow sources: 47; Compiled locks: 47`

Actionlint summary: Checked 47 workflow(s); Found 2 issue(s) (2 error(s)); Issues by type: expression: 2.

Grype summary (severity counts across all 9 images): Critical=20, High=119. Distinct images with vulnerabilities: alpine:latest, ghcr.io/github/gh-aw-firewall/{agent,api-proxy,cli-proxy,squid}:0.28.14, ghcr.io/github/gh-aw-mcpg:v0.4.18, ghcr.io/github/gh-aw-node, ghcr.io/github/github-mcp-server:v1.11.0, node:lts-alpine.

grant: `strict mode: grant found 1250 license policy finding(s) in container images` — final line of report, exit non-zero.

No token-like or credential-like values observed in the report output.

Control plane context

- Correlation ID: `34265698325-704`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34265698325`

> Generated by [:shield: AW Doctor / Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34265698325) · copilot · auto · 42.3 AIC · ⌖ 6.89 AIC · ⊞ 14.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Faw-maintenance-compiler-security%22&type=issues)
> - [x] expires on Sep 22, 2026, 7:13 PM UTC

Start with the affected .github/workflows/*.md sources, especially agentic_commands.yml and the two workflows named in the actionlint findings; review .poutine.yml for license policy. Use the gh aw MCP server's fix and compile entry points without editing generated .lock.yml files. Done means the full compiler, security, and image scans pass, or an unresolved finding is documented.

Written by the indexing model from the issue text.